1. Technical Field of the Invention
The present invention relates to an electronic control apparatus which carries out data checks for a nonvolatile memory.
2. Related Art
It is known in the art to perform data check in determining whether or not an error is present in the data stored in a nonvolatile memory, such as a ROM (read only memory). For example, such data check can be performed in the form of a check sum or the like for the data stored in a nonvolatile memory, at the time of starting up the system and in the idle time of the system in operation. Reference may be made, for example, to Japanese Patent Application Laid-Open Publication Nos. 2004-133635, H10-299565 and H4-001450.
Japanese Patent Application Laid-Open Publication No. 2004-133635 discloses that, in performing data checks, a ROM region is divided into a plurality of cells, and data of a part of the cells are added up at every diagnostic period to thereby perform additions on the data in all of the cells, followed by comparing the sum of the addition values with a reference value.
Japanese Patent Application Laid-Open Publication No. 10-299565 discloses, on the other hand, that a ROM region is divided into a plurality of data groups and it is determined for each of the data groups as to whether or not the data checks have detected a data error.
Japanese Patent Application Laid-Open Publication No. 4-001450 discloses that it is determined either to perform data checks for a ROM region in its entirety, or to perform data check for each of divided regions (sub-regions) of the ROM region, according to the value of the power supply voltage.
Even when data check for a ROM detects a data error on one occasion, this single occurrence of data error may not be used as a basis for determining the occurrence of data error in the ROM, but data check may be retried several times, in order to ensure the reliability of the check operation. If, nevertheless, the several retries have resulted in a data error, then it may be determined that a data error has occurred in the ROM.
However, in the case where data check is performed by calculating a sum of the data in the entire memory region of the ROM, there is a problem that the time taken for the data check will be prolonged in case of finding a data error as a result of the data check, because in such case the data check is retried over the entire memory region of the ROM.
Further, in the case where the memory region of a ROM is divided into a plurality of regions and a data check is performed for each of the divided regions (sub-regions), there is a problem that the time taken for the data check will be prolonged if each of the retries of the data check for the ROM is performed from the beginning.
As described above, when data check has resulted in data error, the time taken for the retries of the data check will be prolonged. If such retries of the data check are performed at the time of starting up the system, for example, the time taken for starting up the system will be problematically prolonged.
In particular, vehicles in these days have a complicated control system which involves a lot of initialization items and initial checkup items at the time of starting up the vehicle system. Therefore, the lengthy time taken for the data check of the ROM will lead to a problem that the time taken for starting up the vehicle system will be prolonged and that the operation of the vehicle system will be delayed.
The present invention has been made in light of the problems described above and has as its object to provide an electronic control apparatus which is able to shorten, as much as possible, the time taken for the retries of data check performed for a nonvolatile memory in the case of data check error.
According to the present invention, an operating means performs check operation for each sub-region. With the check operation, it is checked whether the data stored in the nonvolatile memory is normal or not. If there are any sub-regions which are in data error as a result of the check operation performed by the operating means, retrying means allows the operating means to retry check operation for a predetermined number of times only for the sub-regions that have resulted in data error.
Thus, of the plurality of sub-regions, check operation is executed only for the sub-regions resulted in data error with the previous check operation. Therefore, those sub-regions which are in a normal state need not be subjected to retries of check operation. Thus, even when a data error has occurred during the data check for the nonvolatile memory, the time taken for the retries of data check can be shortened as much as possible. As a result, even when a data error has occurred during the data check executed at the time of startup or during the operation of the system, retries of the data operation can mostly be completed within a time given to the data check. Accordingly, data check for the nonvolatile memory can be executed without delaying other control in the system in which time constraints are particularly tight.
It is preferred that the operating means executes the check operation only for the sub-regions that store data to be used.
Thus, since data checking can be omitted in unused regions of the nonvolatile memory, the time taken for data check can be shortened. In particular, high efficiency can be exerted in the case where the proportion of unused regions is high.
It is preferred that, after completing a data check, the operating means selects the sub-regions that store data to be used in the subsequent process to execute the check operation.
Thus, in the case where a data check for all of the sub-regions cannot be executed at a time because of time constraints, data check can be executed for the data to be used in the subsequent process after completing the previous data check. For example, when there are time constraints at the time of starting the system, the check operation can be executed only for the sub-regions that store data to be used in the process of starting the system. Thus, the system can be started within the constrained time period.
Retries of data check for a predetermined number of times for the sub-regions in question may result in data error. In such a case, the data error is considered to be ascribed, for example, to the abnormality of the check operation per se of the electronic control apparatus having the nonvolatile memory for which the data check is executed, or to data error of the sub-regions in question. In other words, although it may be determined that the electronic control apparatus has malfunction, the cause of the malfunction cannot be identified.
It is preferred that, after the operating means has executed a first check operation as the check operation, the retrying means allows the operating means to execute a second check operation as a retry check operation, which is different from the first check operation, for the sub-regions that have been determined to be in data error by the determining means.
Thus, in the case where the first check operation has resulted in data error, check operation is retried with the second check operation which is different from the first check operation. Therefore, there is a probability that the cause of the data error resulting from the first check operation can be identified, based on the fact that the first check operation has resulted in data error and based on the results of the second check operation. When the cause of the data error resulting from the data check can be identified, the efficiency of analyzing the cause of data error can be enhanced.
It is preferred that if the second check operation for the sub-regions executed by the operating means has resulted in data error, the determining means determines that data of the sub-regions in question are in error; and if the determining means determines that the second check operation executed by the operating means has resulted in normal, the retrying means allows the operating means to retry the first check operation for the sub-regions.
In the case where both of the first and second check operations have detected a data error, the probability is considered to be low in that both of the first and second check operations are abnormal. Accordingly, in the case where both of the first and second check operations have resulted in data error, the data of the sub-regions in question of the nonvolatile memory can be determined to be in error.
Further, in the case where the second check operation has detected no errors, the data of the sub-regions in question can be considered to be normal. In this case, it is considered to be probable that the first check operation per se executed for the first time is abnormal. Therefore, retrying check operation with the first check operation, it may be determined whether or not the data error resulting from the firstly executed first check operation has been caused by the first check operation per se.
It is preferred that if the second check operation for the sub-regions executed by the operating means has resulted in no errors and if the first check operation retried by the operating means has resulted in data error, the determining means determines that the first check operation executed by the operating means is abnormal; and if the first check operation retried by the operating means has resulted in normal, the determining means determines that the sub-regions in question and the operation executed by the operating means are normal.
In the case where the second check operation has resulted in normal and retry of the first check operation has resulted in data error, the data of the sub-regions in question may be determined to be normal and the first check operation per se to be abnormal.
Also, when the second check operation has resulted in normal and retry of the first check operation has resulted in normal, the fact that the first check operation executed for the first time has resulted in data error, is considered to be only a temporal data error due to disturbance, such as noise. Accordingly, the data in the sub-regions in question and the operation performed by the operating means are considered to be normal.
Each of the functions of the plurality of means provided to the present invention is realized by a hardware resource whose configuration per se determines the function, or by a hardware resource whose function is defined by a program, or by the combination of these hardware resources. Further, the functions of the plurality of means are not limited to the functions which are realized by the hardware resources physically independent from each other.